PT-2023-8865 · Unknown+1 · Minizip-Ng+1

Akane0721 · Publicado 2023-11-22 · Atualizado 2024-03-28 · CVE-2023-48106

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions minizip-ng version 4.0.2

Description The issue is related to a Buffer Overflow in the mz path resolve function, located in the mz os.c file, which can be exploited by an attacker using a crafted file. This could allow a remote attacker to execute arbitrary code. The mz path resolve function is part of the minizip-ng library, used for working with zip files.

Recommendations For minizip-ng version 4.0.2, consider disabling the mz path resolve function until a patch is available to prevent potential exploitation. Restrict access to the mz os.c file and related components to minimize the risk of arbitrary code execution. Avoid using the mz path resolve function with untrusted input until the issue is resolved.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

AZL-43840

BDU:2024-02425

CVE-2023-48106

Produtos afetados

Red Os

Minizip-Ng

Referências · 7

• 🔥 https://github.com/zlib-ng/minizip-ng/issues/740 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48106 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-43840 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://bdu.fstec.ru/vul/2024-02425 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-minizip-ng-cve-2023-48107-cve-2023-48106 · Nota
• https://osv.dev/vulnerability/CVE-2023-48106 · Aviso do Fabricante